[Paper Review] Joint Cyber Risk Assessment of Network Systems with Heterogeneous Components

Gaofeng Da, Maochao Xu+2 more|arXiv (Cornell University)|Jun 29, 2020

Complex Network Analysis Techniques24 references4 citations

TL;DR

This paper proposes a backward elimination approach to compute joint cyber risk in network systems with heterogeneous components, accounting for network topology, risk propagation depth, and component-specific compromise probabilities. The method enables explicit computation of joint risk distributions and reveals that increasing propagation depth or compromise probabilities significantly elevates joint risk, with strong positive correlations between compromised node proportions across component types.

ABSTRACT

Cyber risks are the most common risks encountered by a modern network system. However, it is significantly difficult to assess the joint cyber risk owing to the network topology, risk propagation, and heterogeneities of components. In this paper, we propose a novel backward elimination approach for computing the joint cyber risk encountered by different types of components in a network system; moreover, explicit formulas are also presented. Certain specific network topologies including complete, star, and complete bi-partite topologies are studied. The effects of propagation depth and compromise probabilities on the joint cyber risk are analyzed using stochastic comparisons. The variances and correlations of cyber risks are examined by a simulation experiment. It was discovered that both variances and correlations change rapidly when the propagation depth increases from its initial value. Further, numerical examples are also presented.

Motivation & Objective

• To address the challenge of assessing joint cyber risks in network systems with heterogeneous components, where risks are interdependent due to network topology and propagation.
• To develop a computationally efficient method for calculating the joint distribution of compromised components across different types in a network.
• To analyze the impact of propagation depth and direct/indirect compromise probabilities on joint cyber risk using stochastic ordering and simulation.
• To provide a foundation for risk scoring systems in cyber insurance and risk management by quantifying interdependencies among component-level risks.

Proposed method

• Introduces a novel backward elimination algorithm to compute the joint probability distribution of compromised nodes across different component types in a network.
• Defines a propagation depth parameter $ L $ to model the extent of risk propagation, where higher $ L $ indicates greater risk spread.
• Uses multivariate stochastic ordering to theoretically compare joint risk levels under different values of $ L $, $ p_I $, $ p_{II} $, $ q_I $, and $ q_{II} $.
• Employs simulation experiments to examine variances and correlations of compromised node proportions across component types under varying propagation depths.
• Applies explicit formulas for specific topologies (complete, star, complete bipartite) to validate theoretical results and enable tractable risk computation.
• Utilizes stochastic comparisons and contour plots to visualize and analyze the dependence structure between compromised proportions of different component types.

Experimental results

Research questions

• RQ1 How does increasing the propagation depth $ L $ affect the joint cyber risk across heterogeneous components in a network system?
• RQ2 What is the impact of direct and indirect compromise probabilities on the joint risk of different component types?
• RQ3 How do variances and correlations between the proportions of compromised nodes evolve as propagation depth increases?
• RQ4 To what extent do network topology and component heterogeneity influence the joint risk distribution?
• RQ5 Can the proposed backward elimination method provide explicit formulas or efficient simulations for joint risk assessment in both small and large-scale networks?

Key findings

• Increasing the propagation depth $ L $ from 1 to 2 causes a significant and rapid increase in the number of compromised nodes, as confirmed by simulation results.
• When $ L = 10 $, the joint risk is the highest among all tested values, indicating that deeper propagation leads to substantially higher system-wide compromise.
• Positive correlation is observed between the proportions of compromised type I and type II nodes, especially at lower values of $ L $, with the correlation pattern weakening as $ L $ increases.
• Theoretical analysis confirms that the number of compromised nodes of each type stochastically increases with higher $ L $, under multivariate stochastic order.
• Higher direct or indirect compromise probabilities ($ p_I, p_{II}, q_I, q_{II} $) lead to a greater number of compromised nodes, as validated through probability plots and stochastic comparisons.
• The backward elimination approach enables explicit computation for small networks and efficient simulation for large-scale systems, offering practical utility in risk scoring and cyber insurance.